Consumer Health Data Privacy Policy

Refill never asks about your health. But you might tell your coworkers about it in chat: that you're stressed or burnt out, sleeping badly, feeling low, or dealing with an illness or an injury. Anything like that is consumer health data. It comes only from you, in the messages you write and the coworker personas you create. We keep it as part of your chats, and it can end up in the memory notes our AI provider writes so your coworkers remember you (for example, "has been exhausted since the reorg").

Only to provide the game you asked for: to generate your coworkers' replies, keep their memory of you, write the morning message and overnight story, and keep you safe. Every message you send is checked automatically for signs of suicide or self-harm; when one is found, Refill shows you crisis lines, notes the date on your account to pause the morning messages for 7 days, and adds one to an anonymous count that holds no identity. We don't use it for advertising, we don't sell it, and we don't use it to train AI models.

We don't sell consumer health data, and we share it only with the processors that run the game for us, under contracts that let them use it only to provide their service to us. Each one's privacy policy, listed below, says how to contact it.

• OpenAI (openai.com/policies/privacy-policy): writes the coworkers' replies, memory notes and morning messages, and runs the safety checks. It may keep data for up to 30 days to detect abuse.
• Supabase (supabase.com/privacy): stores your chats and memory notes.
• Vercel (vercel.com/legal/privacy-policy): hosts the app that carries your messages.
• Resend (resend.com/legal/privacy-policy): delivers the morning message by email, which can repeat what a coworker says.
• Your browser's push service (such as Google, Apple, Mozilla or Microsoft): delivers morning notifications, encrypted so only your device can read them.

We may also disclose it when the law requires it. We have no affiliates that receive it, and no third party collects it from Refill over time or across other websites.

You can ask us to confirm whether we collect or share your consumer health data, to give you a copy of it along with a list of everyone we've shared it with, and to delete it. You can also withdraw a consent you gave. The quickest way to get a copy is Settings → Your data, and to delete everything, Settings → Account → Delete my account; deleting it also deletes it from our processors (OpenAI's copies expire within 30 days). You can also email refill.work@sapiensq.com from your account's email address.

We respond within 45 days, and may extend that once by another 45 days when it's reasonably necessary, telling you why. We won't treat you differently for using these rights.

Appeals. If we turn down your request, you can appeal by replying to our answer or emailing us with “Appeal” in the subject. We'll answer within 45 days and explain our decision. If we deny your appeal, you can contact the Washington State Attorney General (atg.wa.gov) or the Nevada Attorney General (ag.nv.gov).

If we change how we collect, use or share consumer health data, we'll update this policy and tell you in the app or by email before the change takes effect, and ask for your consent where the law requires it.

Questions? Email refill.work@sapiensq.com. SAPIENSQ, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.